A control plane for thirty-eight portfolio companies.

The shape of the problem

Cordova owns thirty-eight operating businesses across six sectors. Each had its own ERP, its own ledger architecture, and its own approach to access controls. There was no shared posture, no shared evidence, and no shared language for risk.

Internal Audit had been operating in a permanent state of catch-up. Every annual review involved months of bespoke reconciliation. Every incident review was effectively an archaeological dig.

What we did

We did not unify the operating systems. We did not propose a multi-year migration. We deployed Anillion's governance plane in front of the existing environments, treating each portfolio company as a tenant.

The work was four-fold:

1. 01Read each environment honestly. Document what was there.
2. 02Define a single policy model. Express each portfolio company's specifics as a policy variant.
3. 03Connect each environment to the lineage and evidence pipeline.
4. 04Stand up the operator surfaces for Internal Audit, Risk, and the portfolio CTOs.

What changed

• +Internal Audit gained a single, queryable view across thirty-eight entities.
• +Policy exception counts dropped 71% within nine months, primarily because exceptions could now be triaged with context.
• +The annual audit window shrank from twelve weeks to four.
• +New acquisitions could be onboarded onto the governance plane within ten days of close.

The honest part

Cordova's CTO described the deployment as "uncomfortable" — the platform's view of the environment was more honest than the dashboards the team had been operating against. That gap, once visible, was closed quickly. Closing it had been the whole point.